The vulnerability is a use‑after‑free flaw in the Windows Win32 kernel subsystem that allows an attacker with local access to reuse a freed memory object. This bypass can elevate the attacker’s privileges to kernel level, enabling arbitrary code execution and full control over the affected system. The issue is classified as CWE‑416.

Microsoft Windows 11 23H2, 24H2, 25H2, 26H2 and 26H1, as well as Windows Server 2025 and its Server Core variant. Both x64 and ARM64 builds of these releases are impacted.

The CVSS score of 7.8 indicates high severity, but the EPSS score is unavailable, so precise exploitation probability remains unknown. The flaw is not listed in the CISA KEV catalog; however, an attacker would need local or low‑privilege code execution to trigger the use‑after‑free in the Win32 subsystem. No public exploit has been disclosed yet, but the vulnerability can be abused by any user who can run code after the vulnerable free operation.